There were serious technical problems on previous flights
The air flight maintenance log showed six problems had been identified on the plane since 26 October, including errors with its airspeed and altitude information displays.

The plane's angle-of-attack sensor - that measures the angle between the wings and the flow of air - encountered problems and was replaced the day before the crash.

But, according to the preliminary report, problems continued.

In the most recent flight before the crash, from Denpasar on Bali to Jakarta, the pilot issued a "Pan Pan" call - an urgency signal that is one level below "Mayday".

The crew said that the aircraft was operating in abnormal conditions due to instrument failure.

However, they managed to land the plane safely after requesting an uninterrupted descent, and the problems were logged.

The preliminary report says that the stick shaker - a warning device that alerts flight crew when their plane is at risk of stalling - was active throughout the flight.

This was an "un-airworthy condition" and the flight should not have continued, it said.
---------

There is much to learn from the Lion Air Boeing 737 MAX 8 accident in October 2018 that killed all 189 on board, as a preliminary report lays out. DAVID LEARMOUNT considers the potential implications.

The Lion Air Boeing 737 MAX 8 accident may have many specific lessons for the industry but in most respects it is likely to prove yet another casualty of the complicated relationship between pilots and highly automated systems. The pilots found themselves having to deal with what appeared to be a runaway horizontal stabiliser trim system and failed to control it.

Automation issue
So far the Indonesian accident investigator (KNKT) has published only a preliminary factual report but if the automation issue proves to have been a major causal factor when the final report on the crash delivers a verdict, solutions need to be found for this phenomenon. The loss of big jet aircraft and everyone on board just because pilots have difficulty relating to automated control system anomalies is no longer acceptable, even if the results like this are statistically rare. They may be rare but they are plural. Complex systems, especially combined with automation, taking human operators by surprise is an issue that faces not only the aviation industry but many others, including automotive manufacturers seeking automation or vehicle autonomy.

The International Civil Aviation Organisation is quietly working on a new human performance manual that may hopefully, when completed, address many of the human performance issues that are obviously present in the Lion Air accident, even at this early stage in the investigation.

Meanwhile, before considering what could be done to mitigate generic automation-related problems, it is important to understand the specifics of what the Lion Air pilots faced in this very new Boeing 737 MAX 8, if only to discover whether this event contains new lessons, or reveals familiar patterns.

Existing faults
According to the preliminary accident report, the same aircraft (PK-LQP) that crashed fatally on 29 October had suffered faults on flights in the previous three days, many of which appear related to the fault that triggered the aircraft loss. These included speed and altitude disagree alerts on the captain's primary flight display, speed trim and mach trim warnings, auto-throttle malfunction and, on 27 October, a stall alert.

On each flight where the faults occurred, the crews had decided to continue to their destinations. Then, on arrival, they logged the faults for maintenance, and the engineers - following rectification - had declared them cleared before the next flight. Indeed the left angle-of-attack (AoA) sensor was replaced after the flight on the 27th. But then many of the faults recurred.

The KNKT, also known as the National Transportation Safety Committee (NTSC) has - understandably - devoted a lot of space in its preliminary report to what happened on the 28 October flight, the last flight by PK-LQP before the fatal departure. The NTSC did this because both flights suffered an almost identical succession of system faults but the first flight landed safety, and the other crashed into the sea, killing all 189 people on board.

Stick-shaker
Soon after take-off for the flight on the 28th, the captain's stick-shaker activated and remained active and he was presented with IAS and ALT Disagree alerts on his primary flight display. After retracting flaps during the climb he noticed that the stabiliser trim system was running away in the nose-down sense. He told the co-pilot to take over the flying, identified that the problem was with the PFD on his own side, and switched the flight director to the right hand side system so it operated normally for the co-pilot. Whenever the co-pilot relaxed his nose-up trim input via his control column thumb switch, the automatic nose-down stabiliser input resumed. Eventually the force needed on the control column to keep the nose up became very high, so the captain selected the STAB TRIM switches to CUT OUT.

The captain may not have known specifically what had caused the unexpected stabiliser trim activity but the NTSC report notes that - before the flight - the captain, after scanning the maintenance log, had discussed the AoA sensor replacement with an engineer. Then, in-flight, having isolated the electrical input to the stabilisers, the captain decided that the flight could proceed to Jakarta, its scheduled destination, with the crew using manual trim inputs via the centre console trim wheel. The checklist suggests landing at the nearest suitable airfield but the flight landed safely at Jakarta anyway.

On the fatal flight the next day, however, after a similar sequence of events, once the aircraft's stabiliser trim system was triggered, it kept on trimming nose down until the crew could not overcome it with elevator force or the use of control column thumb-switch trim controls, and it dived into the sea at high speed.

The automatic nose-down stabiliser trim on both flights was caused by the programmed reaction of a stall protection system to a faulty AoA sensor on the captain's side. The system is unique to the MAX series, and is known as the manoeuvering control augmentation system (MCAS). MCAS is effectively an AoA-triggered stall protection system that can operate when the flaps are up. In this case, the left hand AoA sensor provided a high reading, differing by 20 Degrees from the one on the copilot's side, and this caused the MCAS to react, pitching the nose down to reduce the AoA. The faulty AoA sensor system on the captain's side was the one that had been replaced by the engineers two days before. Discovering the cause of the AoA sensor faults is one of the subjects of the continuing NTSC inquiry.

Boeing's responseBoeing released a statement in response to publication of the NTSC preliminary report in which it makes this observation: "Unlike as is stated with respect to the prior flight, the report does not state whether the pilots performed the runaway stabilizer procedure or cut out the stabilizer trim switches."

The Indonesian preliminary accident report raises more questions than it answers for the time being but that is not unusual for a preliminary report. Boeing's basic contention is that the information on how to deal with a runway stabiliser trim - regardless of source [cause] - is in the MAX's flight crew operations manual (FCOM), and the company's statement notes that the captain of the flight on 28 October used the non-normal checklist for stabiliser runaway. However pilot associations for airlines in the USA that operate the MAX have professed publicly that there was a widespread ignorance among MAX-qualified pilots of the very existence of the MCAS and also an assumption that a runaway trim would be dealt with in exactly the same way as for all the earlier 737 marques.

The reason for this professed pilot ignorance about the new MCAS system is not clear. Boeing explains the lack of fanfare about the new system by pointing out that it is a "variant" of the speed-related automatic stabiliser trim system on the 737NG series, but adds: "MCAS does not control the airplane in normal flight. It augments the stall recovery characteristics of the airplane in a non-normal part of the operating envelope." The manufacturer also insists it has "discussed MCAS flight control functionality with more than 60 airline operators at several Service Ready Regional Conferences globally since 2016," a statement that is also difficult to reconcile with the claims by US pilot associations.

An experienced Southwest Airlines captain with whom AEROSPACE discussed the MCAS issues says that, in practice, the 737NG and MAX feel the same to fly. He did remark, however, that he was surprised that a single-point AoA sensor failure could be allowed to trigger what feels like a stabiliser trim runaway, venturing his personal opinion that this showed poor system redundancy design.
Pilot conversion to the MAX
Pilots converting from earlier 737 marques to the MAX are not required to undergo a new type rating course, because all 737s are deemed to have sufficient commonality to operate under the same type rating. Thus 737-rated pilots being prepared for the MAX are required only to undergo a brief "differences course". For example, Southwest Airlines pilots do their differences course entirely online and American Airlines the same, so there is no practice in a flight simulation training device. Southwest anticipates getting its first MAX full flight simulator in March 2019.

The type conversion situation appears the same in Europe. Ryanair, which is to take delivery of its first MAXs at its London Stansted base in April 2019, says its differences course will be delivered via computer-based training, the CBT course designed using a combination of Boeing input and Ryanair's own. The airline says it will begin installing its first MAX FFS at its London Stansted training base starting in January.

Although the preliminary report does not mention it, this accident is likely to focus minds on the delicate issue of common type ratings. Manufacturers and operators love them but some experts insist aviation authorities need to be far more critical of them. Even more specifically, are the certification standards around trimmable horizontal stabilisers sufficiently robust?

Meanwhile, over and above the technical argument about the AoA sensor fault triggering MCAS and whether this was a causal factor in the Lion Air crash, the simple fact remains that a crew became confused about what was happening, and as a result failed to implement a checklist procedure that could have prevented the loss of control. That description generates a powerful sense of deja vu.

The preliminary report contains a long list of safety actions to be carried out by Lion Air and the aircraft maintenance providers. The report criticises the crew that survived the 28 October flight from Denpasar to Jakarta for deciding to continue to its destination despite the fact that the captain's stickshaker was operating continuously from just after take-off, which makes the aircraft un-airworthy. It says Lion Air needs to "improve the safety culture", implying that a crew that can make a decision to continue a flight to destination with an un-airworthy aircraft demonstrates the absence of such a culture. It also remarks that the weight and balance sheets showed five cabin crew aboard, whereas there were in fact six of them. The sheer number of repeating faults in the accident aircraft have driven the investigators to call for more accurate technical reporting by crews and better fault troubleshooting, and there is much more.

Complexity-related pilot confusion
Aside from the specific Lion Air lessons, the generic problem of complexity-related pilot confusion needs to be addressed. There is much study ongoing about why such crew confusion events have frequently been precursors to loss of control in flight (LOC-I) during the last 20 years, and whether there are solutions. It has already been established that pilots - the commercial air transport system's goalkeepers - sometimes face shots they did not see coming, so they dive the wrong way.

Answers put forward are many, including improved training inculcating deeper levels of knowledge; conformance with standard operating procedures and improving the quality of information available to pilots. Information, and the way it is presented, is key. Crews in modern flightdecks are bombarded with information to the point where quantity can become the problem rather than the solution.

For example, the classic crew confusion scenario was what happened on Air France flight 447 in the middle of the night over the South Atlantic in 2009. The pitot tubes were momentarily blocked by ice crystals, so the indicated airspeed readings suddenly made no sense and the autopilot tripped out noisily and handed the aircraft back to the pilots because it recognised that its sensor inputs had been corrupted.

There was a drill for the unreliable airspeed scenario, and the AF447 accident report noted that on six previous occasions where airspeed sensor data had been rendered useless, the crews managed to deal with it safely by following procedure. However in AF447 it was two hours after midnight, the pilots were at their absolute circadian low, and the startle effect robbed them of much of their mental capacity. There was plenty of information in front of them providing their aircraft attitude, altitude, power settings and " after about a minute from the IAS loss " a return to accurate airspeed readings. Unable to make sense of what they saw on the instrument panel, they rapidly reverted to instinct, which was disastrous for a crew over a dark ocean on a moonless night.

The aim of improving the quality of data available to pilots is an admirable one but, while it is easy to voice the objective, it is not easy to decide what data should be presented, in what form, and according to what priorities. Messages like "IAS and ALT Disagree" flashing up on one PFD while "simultaneously" the stickshaker is operating (Lion Air), or the autopilot disconnecting and the aircraft's control law changing from normal to alternate (AF447) do not provide the pilots with the essential information to help them ensure safe flight. What is more, such cryptic information risks becoming a dangerous distraction.

The information essentials for a confused pilot are those which help the crew to follow the absolute pilot priorities: aviate, navigate, communicate. The industry needs to resolve these issues to prevent pilot confusion dooming more flights.

Incident: Spicejet B38M near Varanasi on Jan 6th 2019, engine shut down in flight
Jan 6th 2019 17:19Z, last updated Sunday, Jan 6th 2019 17:19Z
A Spicejet Boeing 737-8 MAX, registration VT-MAX performing flight SG-32 from Hong Kong (China) to Delhi (India) with 140 people on board, was enroute at FL340 about 180nm east of Varanasi (India) when the left hand engine (LEAP 1B) shut down due to a restriction in the fuel flow. The crew drifted the aircraft down and diverted to Varanasi for a safe landing on runway 09 about 50 minutes later.

A replacement Boeing 737-800 registration VT-SLI positioned to Varanasi, resumed the flight and reached Delhi with a delay of about 8.5 hours.

Quote:

Incident: Canada B38M over Pacific on Dec 24th 2018, hydraulic quantity decreasing
Friday, Dec 28th 2018 20:48Z, last updated Friday, Dec 28th 2018 20:48Z
An Air Canada Boeing 737-8 MAX, registration C-FSCY performing flight AC-535 from Vancouver,BC (Canada) to Kahului,HI (USA) with 167 passengers and 6 crew, was enroute over the Pacific Ocean about 2 hours into the flight when the crew noticed the hydraulic quantity A had reduced to 67% and was degrading. The crew consulted with dispatch and maintenance, a decision to continue the flight was reached, the crew should report the situation within an hour again. 30 minutes later the quantity had reduced another percent, and another 30 minutes later the quantity had reduced to 65%. In the following discussion with dispatch and maintenance the decision was made to return to Vancouver. The aircraft landed safely back in Vancouver about 3 hours after the decision to return.

The Canadian TSB reported the operator's maintenance is investigating the causes.

A replacement Boeing 737-8 MAX registration C-FSOC reached Kahului with a delay of about 10 hours.

Quote:

Incident: Argentinas B38M near Cordoba on Dec 14th 2018, engine vibrations as result of weather
Friday, Dec 14th 2018 21:31Z, last updated Saturday, Dec 15th 2018 21:17Z
An Aerolineas Argentinas Boeing 737-8MAX, registration LV-HKU performing flight AR-1324 from Buenos Aires,BA (Argentina) to Punta Cana (Dominican Republic), was enroute at FL310 about 20nm west of Cordoba,CD (Argentina) and bout 270nm south of Tucuman,TU (Argentina) when the aircraft entered a zone of adverse weather, an engine (LEAP) began to vibrate as result. The crew reduced the engine to idle thrust, drifted the aircraft down to FL270 and diverted to Tucuman where the aircraft entered a hold to burn off fuel and landed safely on runway 02 about 3 hours after leaving FL310.

A replacement Boeing 737-8MAX registration LV-HKW departed Tucuman about 7.5 hours after LV-HKU landed and is estimated to reach Punta Cana with a delay of about 9.5 hours.

On Dec 15th 2018 The Aviation Herald learned that while flying in that zone of adverse weather one of the engines began to vibrate prompting the crew to reduce the engine to idle and divert to Tucuman. Initial information, confirmed by the airline, had indicated an engine failure and shut down of the engine.

The occurrence aircraft returned to service about 29.5 hours after landing in Tucuman.

Iran's CAO reported initial reports suggest the crew received an engine oil low pressure indication on the #1 engine, shut the engine down, burned off fuel and landed in Shiraz.

A passenger reported the crew announced an engine oil problem requiring them to shut the engine down and divert to Shiraz.

A replacement Boeing 737-800 registration LN-DYG positioned from Oslo to Shiraz as flight DY-8920 landing in Shiraz about 11.5 hours after LN-BKE, the aircraft has not yet departed Shiraz an hour after landing in Shiraz.

Quote:

Incident: Sunwing B38M near Washington on Nov 14th 2018, multiple system failures
Nov 20th 2018 20:04Z, last updated Tuesday, Nov 20th 2018 20:04Z
A Sunwing Airlines Boeing 737 MAX 8, registration C-GMXB performing flight WG-439 from Punta Cana (Dominican Republic) to Toronto,ON (Canada) with 176 passengers and 6 crew, was enroute at FL350 about 50nm northwest of Washington Dulles Airport,DC (USA) when the captain's instruments began to show erroneous indications. The first officer was handed control of the aircraft as his instruments and the standby instruments remained in agreement. The crew decided to descend out of IMC into VMC as a precaution and descended the aircraft to FL250. Descending through FL280 the weather radar and TCAS failed. The crew declared PAN and worked the related checklists. The left IRS fault light illuminated. The flight continued to Toronto for a safe landing without further incident.